use POST for update, not PUT